The invention relates to a method for managing authentication keys in a mobile communication system comprising at least one authentication center, base stations and mobile stations to which subscriber identity modules may be coupled and which communicate with said base stations.
The invention is intended to be applied in mobile communication systems in which subscribers may be identified by means of a subscriber identity module which is either in the mobile stations or may be coupled to it. An example of such a mobile communication system is represented by the GSM system (Global System for Mobiles). Another example of such a mobile communication system is the TETRA radio telephone system (TETRA=Trans European Trunked Radio). The TETRA radio telephone system is an example of the PMR (=Private Mobile Radio) radio telephone system.
The telecommunications network checks a subscriber's identity by carrying out an Authentication Procedure to be sure that the subscriber identity given by the mobile station is correct. By checking the subscriber identity, the network makes it sure that only such subscribers who have the right to use the network services are able to use them. At the same time it is ascertained that an unauthorized user will not cause any extra costs to entitled users or be able to impersonate another subscriber.
In the following, the checking method of a subscriber's identity will be described in more detail by means of a GSM-related example. Similar principles are also applicable to systems of the GSM type and to the Tetra system. The mobile communication system always checks a subscriber's identity in conjunction with registration, call set-up stage and when activating or deactivating certain supplementary services. The subscriber identity is also checked at Location Area (LA) updating in cases the subscriber's roaming number i.e. MSRN (Mobile Station Roaming Number) changes. In other location area (LA) updating instances, the network operator may decide whether to check a subscriber's identity or not.
A subscriber's identity is checked according to the following steps:
Having obtained information of the situation described above, which initiates checking of the subscriber's identity, the mobile communication system, for example its Authentication Center (AUC) transmits a random number RAND to the mobile station, the RAND being generated in the system. Having received the RAND, the mobile station computes, by a specific algorithm, the received RAND, and an Authentication Key K previously stored in the mobile station, a value for an acknowledgment parameter SRES. Hence, the key K is stored at least in the authentication center and the mobile station so that they are both able to compute the same reference numbers. The mobile station sends the acknowledgment parameter SRES to the mobile communication network, in particular to its authentication center, which checks the parameter SRES value, computed in the mobile station, i.e. compares it to the value it has computed, and as a result of this comparison deducts whether the subscriber who transmitted the acknowledgment parameter is an authorized subscriber.
The mobile stations used in mobile communication systems have a subscriber identity and an authentication key stored in a subscriber identity module, which may be attached to the mobile station detachably or integrated therein. The subscriber identity modules which are coupled detachably to the mobile station and which contain the identifiers of the subscribers may, when required, be connected to a terminal equipment to form a mobile station. Such subscriber identity modules and mobile stations to which the subscriber identity module is integrated are usually subscriber-specific and they are identified by a subscriber's secure identifier (IMSI=International Mobile Subscriber Identity or ITSI=Individual Tetra Subscriber Identity). Detachable subscriber identity modules include e.g. SIM cards (SIM=Subscriber Identity Module).
The subscriber identity module described above, such as a SIM card, is subscriber specific, which means that subscriber equipments are not confined to a specific subscriber. The subscriber identity module, such as a SIM card, is a smart card which is placed in the mobile equipment and which contains information, e.g. an authentication key K, required for identifying a subscriber and for encrypting radio traffic. A subscriber identity module, such as a SIM card, in this application refers to a functional card that can be removed from a mobile equipment and by means of which a subscriber is able to use a card controlled mobile equipment.
If a subscriber identity module e.g. a SIM card is employed, the user need not have a mobile equipment of his own, but a subscriber identity module e.g. a SIM card issued to him by the operator of the mobile communication system is all he needs. Such a subscriber identity module is, in a way, a phone card by means of which the subscriber can make (and receive) calls from any mobile equipment of the system. The functions of the SIM card on the one hand include providing the mobile station with data indicating the user in a well protected manner and on the other hand to offer services to the mobile station. Such services may include e.g. maintaining (inputting, changing) a Personal Identification Number (PIN), maintaining the data protection key i.e. the authentication key K, and unblocking by e.g. a PUK code, Personal Unblocking Key, a SIM card blocked by too many attempts of inputting a wrong PIN.
To incorporate a SIM card in hand-held phones, a so-called plug-in-SIM has been introduced as an alternative way of implementing a subscriber identity module. A plug-in-SIM is approximately a coin-sized part containing the electronics of a credit card sized SIM card, and it is placed in a phone so that the user is not able to replace it with ease. The phone may also have an incorporated plug-in-SIM and, in addition, a card reader. If the card reader contains a card, the phone is identified on the basis of the external card, otherwise on the basis of the incorporated plug-in-SIM. Unless the context gives reason to some other interpretation, the term subscriber identity module, such as a SIM card, in this application refers to the plug-in-SIM, the credit card sized smart card SIM, and the subscriber identity module which is incorporated in the mobile station and which contains the subscriber identity and the authentication key K.
In addition to mobile communication systems according to the GSM mobile communication system, the method of the invention is intended for use also in PMR (Private or Professional Mobile Radio) networks, i.e. trunked networks which are typically company networks or public safety and security networks, in which all the channels are used by one or more companies or public authority groups. The security of the networks used by the authorities is set stricter security demands than the normal GSM network.
In the following, the management of the authentication key K is described in normal operation according to the GSM system. When a subscriber acquires a subscriber identity module, for example a SIM card (SIM=Subscriber Identity Module), the subscriber's IMSI, authentication key K and encryption algorithms are stored in the SIM card. The IMSI and the authentication key K are additionally stored in the authentication center AUC of the subscriber's home PLMN (Public Land Mobile Network). Each PLMN comprises one or more authentication centers.
In the GSM system, two key managing methods have been defined. When using the one which is protected better there is no need to transfer the key from a place to another. When employing the method protected worse, the key is transferred within the network, which results in that the method is allowed to be used only when it is not necessary to transfer encrypted information between PLMNs. At other times, the network may decide which one of the methods to employ.
In the following, the safer of these methods is described, i.e. the one in which the subscriber identity is confirmed without transferring the authentication key K. In this method, a suitable network element, e.g. a Base Station (BS) or a Mobile Switching Center (MSC) per each mobile station may request secret subscriber-specific information from the AUC in the home PLMN of the mobile station. The authentication center is either a separate unit or a part of a HLR (Home Location Register). The secret information in this case includes a table of RAND/SRES pairs, which have been obtained by using an algorithm with known values of the parameters RAND and the authentication keys K. The pairs are normally stored in a visitor location register VLR.
Subscriber identification in the Tetra system is described in "prETS 300 392-7, September 1995, Radio Equipment and Systems (RES); Trans-European Trunked Radio (TETRA); Voice plus Data (V+D); Part 7: Security, ETSI, pp. 8-10 and pp. 28-32". In Tetra systems, the authentication key is stored in the mobile communication network in a safe database of a subscriber's home network. In the terminal equipment, in turn, the authentication key may be generated in three different ways, which are described in the aforementioned document. One of the methods for generating the authentication key in the terminal equipment is to use in the authentication a User Authentication Key (UAK) stored in the subscriber equipment.
Carrying out authentication of mobile subscriber securely is the more important the higher level of security is to be achieved in the mobile communication system/network. This matter is also influenced by other solutions of the network: if, for example, the network-internal subscriber number IMSI and the subscriber number MSISDN (Mobile Subscriber International ISDN number) employed by the users are separate, as is the case in the GSM system, flexible use is possible so that the actual subscriber number MSISDN and subscriber data corresponding thereto are defined afterwards for the pair constituted by the allocated IMSI and the authentication key K. This means that it is possible to store in advance the same subscriber identifiers IMSI and the same authentication keys K to the subscriber identity module and the authentication center of the mobile communication system without having to transfer them on a radio path, which is subject to jamming and eavesdropping.
Naturally, it is also possible to define subscriber numbers, such as MSISDN or ITSI numbers, for the subscriber identity modules, e.g. SIM cards, in conjunction with programming the keys. In such a case, distributors would be given cards which have subscriber numbers entered in them, whereas the other subscriber data would only be fed in the system when a new subscriber is defined. A problem here is that subscribers would not have any chance to choose or form a suitable subscriber number which the user finds easy to remember or which would identify that user in some other way, for example by name. Further, this solution does not allow the different levels and fleets of a public authority organization to be described in a systematic manner by means of subscriber numbers of the members of these organizations as it is not possible to know in advance how many new members there will be in the organization, and which hierarchical identifiers to give afterwards to each member of the organization.
A way to solve the problems set forth would be to centralize the generation, subscriber definition and the system authentication i.e. the key database (AUC) of subscriber identity modules e.g. SIM cards to one place. Such centralization of all the key and subscriber management in one location is not, however, a sensible solution from the users' point of view. It must be possible to define new subscribers and to give out SIM cards in several places, for example in public safety and security networks at police stations and alarm receiving centers, and in commercial networks at distributor agencies.
Therefore, the above way of operation would be problematic since in normal mobile communication systems a number of different organizations, e.g. operators, retail dealers of mobile stations as well as service providers wish to provide their clients promptly with subscriber identity modules incorporated in or connected detachably to the mobile station, and with subscriber numbers suitable for the subscribers.
In such a case, a method in which subscriber numbers have been pre-stored in SIM cards is not rational due to its inflexibility. Consequently, a police patrol, for example, could not be issued a number in conjunction with the defining stage, but a number pre-stored on a SIM card, which is somewhere in the distribution chain, has to be chosen.
This feature is particularly manifest in public safety and security networks, because e.g. the TETRA standard does not allow a separate MSISDN number used by subscribers (MSISDN=mobile subscriber international ISDN number) and an IMSI (international mobile subscriber identity) number used network internally.
In addition, in e.g. public safety and security networks, a network may have several groups of public authority users, such as the police, fire brigade, customs, etc., each desiring to distribute and define separate subscriber identity modules for their respective users with the subscriber identifiers in these modules being possible to organize in a hierarchical order, for example fleet by fleet, even after authentication keys have been stored in them.
The authentication keys should not be possible for people to read at any stage, and they should be stored only in connection with the subscriber data of the system and on the SIM card, and they should not be transferred in the network. This means that the keys will have to be generated in a centralized manner in one location both to the system and to the subscriber identity module, such as a SIM card.